AWS is the world largest cloud platform. The AWS shared responsibility model means AWS secures the cloud infrastructure — customers are responsible for everything inside: IAM, S3, VPC, encryption, and monitoring. Misconfigurations cause more cloud breaches than any vulnerability in AWS infrastructure itself.
The Shared Responsibility Model
AWS secures: physical infrastructure, hardware, networking, hypervisors. Customers secure: IAM, OS patching, application security, network configuration within AWS, data encryption, and access control. Understanding this division eliminates the most common source of cloud security gaps.
IAM: Most Critical AWS Control
Root Account Protection
Delete root account access keys immediately after account creation. Enable MFA on root using a hardware FIDO2 key. Never use root for daily operations. Alert on any root account login via CloudWatch.
Least Privilege IAM Policies
Most common AWS mistake: overly permissive IAM policies. Best practices: use AWS-managed policies as starting points, deny by default, avoid wildcard actions (*:*) except where operationally required, use IAM Access Analyzer to identify over-permissive policies, require MFA for sensitive actions via condition keys, use permission boundaries for IAM role creation.
IAM Roles over Users
Prefer IAM Roles over long-term access keys. EC2 instances should assume instance roles. Lambda functions should assume execution roles. CI/CD pipelines should use IAM roles via OIDC federation. Long-term access keys are the most frequently stolen AWS credential type.
S3 Security
Enable S3 Block Public Access at account level (prevents any bucket going public). Enable default encryption on all buckets (AES-256 or AWS KMS). Enable S3 access logging to a centralized security bucket. Enable Versioning and MFA Delete on sensitive buckets. Use S3 Object Lock for compliance and ransomware protection.
AWS GuardDuty and CloudTrail
GuardDuty is ML-powered threat detection analyzing CloudTrail logs, VPC Flow Logs, and DNS logs. Cost: approximately $3-15/month for small environments. Enable in all regions and all member accounts via AWS Organizations. Enable organization-wide CloudTrail in all regions with log file integrity validation. Store in a centralized locked S3 bucket. Alert on: root account logins, console logins without MFA, security group changes, IAM policy modifications, CloudTrail being disabled.
VPC Security
Security Groups: never allow 0.0.0.0/0 on SSH or RDP from the internet. Use security group IDs as sources for internal traffic. Audit quarterly for overly permissive rules. Network ACLs: provide stateless filtering at subnet level, deny known malicious IP ranges, restrict inter-subnet traffic to required protocols.
AWS Security Hub
Aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer into a single dashboard. Enable with CIS AWS Foundations Benchmark. Target Security Score 90%+. Security Hub provides the most efficient single view of AWS security posture.
🔗 Further Reading
FAQs
What is the AWS shared responsibility model?
AWS secures the physical infrastructure, hardware, networking, and hypervisors (security of the cloud). Customers are responsible for IAM, OS patching, application security, data encryption, and access control within AWS (security in the cloud). Most cloud breaches exploit customer-side misconfigurations, not AWS infrastructure vulnerabilities.
What does AWS GuardDuty detect?
GuardDuty detects: EC2 cryptocurrency mining, compromised instances phoning home to C2, unusual API calls from Tor exit nodes, S3 data exfiltration, IAM privilege escalation attempts. It uses ML on CloudTrail, VPC Flow Logs, and DNS logs. Enable in all regions for approximately $3-15/month for small environments.
Key Takeaways
- Protect root account with hardware MFA and delete all root access keys
- Apply least-privilege IAM policies — IAM Access Analyzer identifies over-permissive ones
- Enable S3 Block Public Access at account level to prevent accidental data exposure
- GuardDuty is the highest ROI AWS security service at $3-15/month
- CloudTrail in all regions with integrity validation is non-negotiable
Conclusion
AWS security centers on identity, data, and visibility. Apply least-privilege IAM, S3 Block Public Access, GuardDuty, and CloudTrail. Related: AWS Cloud Security Checklist.
Sources
- AWS Security Best Practices – docs.aws.amazon.com
- CIS Amazon Web Services Foundations Benchmark – cisecurity.org
- AWS GuardDuty Documentation – docs.aws.amazon.com
